Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add generic password matching within XML files #1032

Open
wants to merge 6 commits into
base: master
Choose a base branch
from

Conversation

AnthonyPoschen
Copy link

@AnthonyPoschen AnthonyPoschen commented Nov 14, 2022

Example XML this resolves matching.

        <server>
            <id>releases</id>
            <username>foo</username>
            <password>my-super-secret-password</password>
        </server>

Resolves: #908

Description:

This PR aims to enable finding secrets within xml files by changing the generic Regex pattern matching to include a closing value of "<" to the secret suffix

Checklist:

  • Does your PR pass tests?
  • Have you written new tests for your changes?
  • Have you lint your code locally prior to submission?

Copy link

@jit-ci jit-ci bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❌ Jit has detected 1 important finding in this PR that you should review.
The finding is detailed below as a comment.
It’s highly recommended that you fix this security issue before merge.

cmd/generate/config/rules/rule.go Show resolved Hide resolved
@zricethezav
Copy link
Collaborator

@AnthonyPoschen I agree, < can be added to the closing suffix. Care to fix the conflicts?

AnthonyPoschen and others added 2 commits January 15, 2024 17:24
Example XML this resolves matching
```
        <server>
            <id>releases</id>
            <username>foo</username>
            <password>my-super-secret-password</password>
        </server>
```
@AnthonyPoschen
Copy link
Author

@zricethezav conflicts are resolved

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Default Generic API rule - does not scan secrets in XML tags
2 participants